To: 


Of: 


İCO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Pownall Marketing Limited 


4 Adamson House, Towers Business Park, Manchester M20 2YY 


The Information Commissioner (“Commissioner”) has decided to issue 
Pownall Marketing Limited (“PML”) with a monetary penalty under 
section 55A of the Data Protection Act 1998 (“DPA”). The penalty is 
being issued because of serious contraventions of regulation 21A and 
24 of the Privacy and Electronic Communications (EC Directive) 
Regulations 2003 (“PECR”). 


This notice explains the Commissioner’s decision. 


Legal framework 


PML, whose registered office address is given above (Companies House 
Registration Number: 11674329) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 
in relation to claims management services contrary to regulation 21A of 
PECR. 


Regulation 21A paragraph (1) of PECR provides that: 
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“(1) A person must not use, or instigate the use of, a public electronic 


communications service to make unsolicited calls for the 


purposes of direct marketing in relation to claims management 


services except in the circumstances referred to in paragraph 


(2)." 


5. Regulation 21A paragraphs (2), and (3) provide that: 


“(2) Those circumstances are where the called line is that of a 


subscriber who has previously notified the caller that for the time 


being the subscriber consents to such calls being made by, or at 


the instigation of, the caller on that line 


(3) A subscriber must not permit the subscriber's line to be used in 


contravention of paragraph (1).” 


6. Regulation 21A paragraphs (4), and (5) materially state that: 


“(4) In this regulation “claims management services” means the 
following services in relation to the making of a claim— 


(a) 
(b) 
(c) 
(d) 
(e) 


advice; 

financial services or assistance; 

acting on behalf of, or representing, a person; 

the referral or introduction of one person to another; 


the making of inquiries. 


(5) In paragraph (4), “claim” means a claim for compensation, 
restitution, repayment or any other remedy or relief in respect of 
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loss or damage or in respect of an obligation, whether the claim is 
made or could be made— 


(a) by way of legal proceedings, 
(b) in accordance with a scheme of regulation (whether 


voluntary or compulsory), or 


(c) in pursuance of a voluntary undertaking. 
Regulation 24 of PECR provides: 


“(1) Where a public electronic communications service is used for the 
transmission of a communication for direct marketing purposes 
the person using, or instigating the use of, the service shall 
ensure that the following information is provided with that 


communication - 


(b) in relation to a communication to which regulation 21 
[or 21A] (telephone calls) applies, the particulars 
mentioned in paragraph (2)(a) and, if the recipient of 
the call so requests, those mentioned in paragraph 


(2)(b). 


(2) The particulars referred to in paragraph (1) are - 


(a) the name of the person; 
(b) either the address of the person or a telephone 


number on which he can be reached free of charge 


Consent is defined in Article 4(11) the General Data Protection 


Regulation 2016/679 as “any freely given, specific, informed and 
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unambiguous indication of the data subject’s wishes by which he or 


she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her. 


9. A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


10. Under section 55A (1) of the DPA (as amended by the Privacy and 
Electronic Communications (EC Directive) (Amendment) Regulations 
2011 and the Privacy and Electronic Communications (EC Directive) 
(Amendment) Regulations 2015) the Commissioner may serve a 
person with a monetary penalty notice if the Commissioner is satisfied 
that - 


“(a) there has been a serious contravention of the requirements of the 
Privacy and Electronic Communications (EC Directive) Regulations 
2003 by the person, and 

(b) subsection (2) or (3) applies. 

(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


11. 


12. 


13. 
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The Commissioner has issued statutory guidance under section 55C (1) 

of the DPA about the issuing of monetary penalties that has been 

published on the ICO’s website. The Data Protection (Monetary 

Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 


that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR implemented European legislation (Directive 2002/58/EC) aimed 
at the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR were amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 
strengthened the 2002 provisions. The Commissioner approaches the 


PECR regulations so as to give effect to the Directives. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 


14. 


15. 


PML first came to the attention of the Commissioner when it was 
discovered that a number of complaints had been received by both the 
Commissioner and the Telephone Preference Service (“TPS”) in relation 
to unsolicited direct marketing calls. It was notable that many of the 


complaints appeared to be about an organisation which referred to 


itself as p, or ‘MM, or some variation thereof. 


Using the Calling Line Identification Numbers (“CLIs”) from which the 
complaints originated, the Commissioner undertook enquiries with the 
relevant Communications Service Provider (“CSP”) to establish the 


identity of the subscriber. It was revealed that the subscriber of the 
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CLIs provided was PML, and that there were in fact a total of 61 CLIs in 


use by this subscriber. 


Using these 61 CLIs as reference, the Commissioner sought to produce 
a log of the recent complaints made to the Commissioner/TPS about 
calls from these lines, noting that almost all complaints expressly 
concerned claims management and appeared to be about the same 


organisation. 


In light of this, the Commissioner sent an initial investigation letter to 
PML on 2 May 2019, to which an initial response was first received on 
30 May 2019 from a compliance consultant who had been instructed to 
act on PML’s behalf. 


The response indicated that PML acted as a “marketing agent” for 
another company which called itself i i 7 777 _ 7 
CH ) (discovered later to be an Indian company based in 
Ghaziabad). MM supplied the data that PML would use in its 


campaigns, and it was said that any leads would be passed back 


directly to I. 


This response failed however to address the specific questions within 
the Commissioner’s initial letter and so the request for this information 
was repeated. The Commissioner was subsequently told that only 13 
CLIs were used by PML, however the Commissioner noted that these 
CLIs were provided with ‘event dates’, the meaning of which was not 


clear. 


A copy of a script allegedly used in the direct marketing was also 


provided, an extract of which stated that: 


21. 


22, 


23. 
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My name is ...... and I’m calling from GH which is a trading style of 
how are you today? 


The reason for the call today is we believe you have consented to 
receive a marketing call in relation to a road traffic accident you’ve 
been involved in over the last 3 years...is this correct? 


OK, so what I can do for you today to get this explained in as much 
detail as possible, I can get you through to one of our closers who will 
run through some simple criteria and if you meet this we can then send 
you through to a solicitor who can then deal with the claim for you” 


This script confirmed to the Commissioner that J was a name which 
PML were using to identify itself to recipients, and also appeared to 
contradict what the Commissioner had previously been told in respect 
of the leads being passed back to J when in fact the script 


suggested that they would be passed through to a solicitor. 


Amongst copies of various training documents, a copy of a single page 
contract/agreement between PML and EE was also provided, 
however this contract was silent as to the requirements of PECR, and 
provided only a brief, vague assurance that the data being supplied to 
PML would be compliant with the Data Protection Act 2018 and the 
General Data Protection Regulation (“GDPR”). It also mentioned that 
data would be screened against the TPS register, and that payment for 


services provided by PML would be £6,000 per month. 


PML confirmed that this brief assurance was the extent of its due 
diligence in respect of the data it was to use to make its direct 
marketing calls, stating that PML “was just acting for J and 
wrongly thought that [J was the firm responsible for 


everything”. 


24. 


25. 


26. 


27. 


28. 
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On 7 June 2019 the CSP provided the Commissioner with a number of 
spreadsheets detailing the Call Dialler Records (“CDRs”) for the 61 CLIs 
attributed to PML from 1 January 2019. These CDRs were later filtered 
to give the number of those calls which connected to a subscriber. It 
was established that between 1 January 2019 and 28 May 2019 there 
were a total of 554,753 outbound calls, of which 365,369 connected to 


a subscriber. 


The Commissioner made further enquiries with PML, specifically in 
relation to the consents that it purported to rely on in relation to the 
complaints received; the volumes of calls it believed it had made; and 


the CLI discrepancy. 


PML responded to say that it believed it had made 237,356 calls 
although there was no evidence provided to support this figure; and it 
maintained that the 13 CLIs it had previously disclosed were accurately 
listed as the only ones used by PML. PML had at this point taken steps 
to request evidence of consent from B. 


Noting the dispute regarding the CLIs being attributed to PML, the 
Commissioner took steps to ascertain the correct number with the CSP 
which confirmed that the 13 CLIs which PML had insisted were the only 
ones used by it were in fact CLIs that had been added to an existing 
account which PML had taken over, and on which there were already a 
number of CLIs active and allocated for PML’s use. The ‘event dates’ 
on the 13 additional CLIs, as provided previously by PML, was clarified 
to mean the dates on which those particular CLIs were added to PML’s 


account. 


On 28 July 2019, in respect of the request for evidence of consent, PML 
provided screenshots of four general ‘consent statements’, cropped and 


with the domain names not visible. The Commissioner queried this and 


29. 
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31. 


32. 
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received details of three website domains to which three of the four 
‘statements’ provided allegedly belonged. None of these three website 
domains, either on the website itself or the privacy policy, currently or 
in any historic version that can be seen online, mentions PML as a body 
which may contact subscribers. Indeed, two of the websites cited are 
inactive, and have been so for at least 12 months prior to the 


incorporation of PML. PML have been unable to provide the 


Commissioner with any evidence of specific consent. 


The Commissioner sent an ‘end of investigation’ letter to PML on 25 
September 2019 to advise that the matter would be considered for 
regulatory action. On 7 October 2019 PML applied to strike the 

company off the Companies House register. The Commissioner has 
since successfully objected to this application and, as of this Notice, 


PML remains an ‘active’ legal entity. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 

The Commissioner has considered whether those facts constitute a 
contravention of regulations 21A and 24 of PECR by PML and, if so, 
whether the conditions of section 55A DPA are satisfied. 


The contravention 


The Commissioner finds that PML contravened regulations 21A and 24 
of PECR. 


The Commissioner finds that the contraventions were as follows: 


34. 


35. 


36. 


37. 


38. 


39. 


40. 
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Regulation 21A was brought into force on 8 September 2018 and 


requires that persons/organisations hold consent from subscribers in 


order to make calls relating to claims management services. 


Between 1 January 2019 and 28 May 2019 PML used a public electronic 
communications service for the purpose of making 365,369 unsolicited 
calls for direct marketing purposes to subscribers in relation to claims 


management services, resulting in 63 complaints. 


The Commissioner is satisfied for the purposes of regulation 21A that 
these calls were made to subscribers who had not given their prior 


consent to PML to receive such calls. 


Further, PML failed, as required by regulation 24 of PECR, to provide 
the recipient of the calls the particulars specified at regulation 24(2), 
instead, seeking to disguise its identity by using W, or a variation of 


such, through which they would not be directly traceable. 


The Commissioner is satisfied that PML was responsible for the 


contraventions. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contraventions identified 

above were serious. This is because there have been multiple breaches 
of regulations 21A and 24 by PML over a 5-month period. Between 1 
January 2019 and 28 May 2019, PML made a total of 554,753 calls 
relating to claims management services to subscribers, 365,369 of 


these calls were connected. This led to a significant number of 
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complaints about unsolicited direct marketing calls in relation to claims 


management services. 


The legislation is clear that TPS registration is not a relevant 
consideration in respect of such calls. A subscriber must have 
previously notified the caller that for the time being the subscriber 
consents to such calls being made by, or at the instigation of, the caller 
on that line. The Commissioner is satisfied that PML did not have the 


necessary consent to make these calls. 


PML are not registered with the FCA for the purposes of carrying out 
regulated activities, and used misleading tactics when making the calls 
to subscribers, as evidenced by the content of some of the complaint 


extracts: 


- “Started by pretending to be from my insurance company 
saying it was a courtesy call to see how my claim was going.” 


- “Trying to convince me that there is a payment waiting for me 
for a sum that is way less than I will be getting for the 
accident.” 


- “They do not clearly state what they are trying to do. The 
"Sales" rep is clearly trying to mislead potential clients to 
agree to them broking a claim to receive a fee.” 


- “The caller tried to trick me with false information regarding a 
biking accident.” 


- “Company claimed to be working for Hadtings [sic] insurance 
which was false as I rang Hastings.” 


- “Claiming to be working on behalf of my insurance company, 
when I challenged them to who my insurance was with, they 
hung up.” 


- “Claimed to be from my insurance (which i checked and 
nothing to do with them).” 


43. 


44. 
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- “They purported to be associated with my insurance 
company.” 


- “Claiming to be working on behalf of my insurance company.” 


- “Company claiming to work on behalf of Association of British 
Insurers.” 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contraventions 
identified above were deliberate. The Commissioner considers that in 
this case PML did deliberately contravene regulations 21A and 24 of 
PECR. 


The ICO has published guidance on its website for companies carrying 
out marketing explaining their legal requirements under PECR. This 
guidance, which includes information about the change in legislation 
regarding claims management calls, states that since the 
implementation of Regulation 21A into PECR, unsolicited calls for direct 
marketing purposes in relation to claims management services cannot 
be made unless the subscriber has specifically consented to receiving 
the call. There is no evidence that PML has considered its legal 
obligations in this regard at all, instead relying on vague and general 
assurances of compliance with other data protection legislation from 
GS, its overseas data provider, with no apparent reference to 
PECR in any of the disclosed documentation from PML. PML appear 
content to deflect responsibility, stating during the investigation that it 
believed J were “responsible for everything”. 


46. 
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PML has advised that the data used for its direct marketing calls was 
provided directly from a, and that there was no due diligence 
carried out by PML as to the veracity of the data. It is notable that the 
Commissioner's direct marketing guidance makes clear that 
organisations utilising marketing lists from a third party must 
undertake rigorous checks to satisfy themselves that the personal data 
was obtained fairly and lawfully, that their details would be passed 
along for direct marketing to the specifically named organisation in the 
case of live calls, and that they have the necessary consent. It 
appears that it was only when specifically requested by the 
Commissioner did PML take steps to contact JJ to obtain 
evidence of consent, and was in any event unable to do this, providing 
instead copies of generic ‘consent statements’ with no mention of PML’s 
company name. The Commissioner is further concerned that two of 
the three website domains from which the consents were apparently 
obtained do not even appear to have been active for over twelve 
months prior to PML’s incorporation and so could not possibly have 
been used to obtain valid consent. The Commissioner feels the 
inclusion of this information from PML is little more than an attempt to 
create the illusion of a business strategy, and if considered in any detail 
could not have possibly provided PML with any comfort that their direct 


marketing calls would be lawful. 


The Commissioner is further alarmed by PML’s failure to provide its 
particulars on its calls, instead using trading names linked to its 
overseas data provider, which can be seen as nothing less than an 
attempt to deliberately conceal the true identity of the caller contrary 
to regulation 24 of PECR. 


For the above reasons, the Commissioner is satisfied that this breach 


was deliberate. 
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In the alternative however, the Commissioner has also gone on to 


consider whether the contraventions identified above were negligent. 


The Commissioner has considered whether PML knew or ought 
reasonably to have known that there was a risk that these 
contraventions would occur. She is satisfied that this condition is met, 
given that the issue of unsolicited calls, particularly in relation to claims 
management services, has been widely publicised by the media as 
being a problem, and indeed led to a specific change in the legislation. 
Given that the very nature of PML’s business model appears to be 
claims management lead generation, it is reasonable to suppose that 
PML should, and indeed must, have been aware of their responsibilities 


in this area. 


Secondly, the Commissioner has gone on to consider whether PML 
failed to take reasonable steps to prevent the contraventions. Again, 
she is satisfied that this condition is met. Indeed, it would appear to be 
the case that PML has failed to take any steps whatsoever to prevent 
these contraventions, relying instead on vague assurances from its 


overseas data supplier that it was acting in compliance with the law. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


The Commissioner has also taken into account the following 


aggravating features of this case: 


54. 
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e PML appear to have employed misleading sales practices, 


including allusions to being aligned with legitimate insurance 


companies, as reported to the Commissioner by subscribers; 


e The purpose of the calls, in generating leads for profit, is a 


deliberate act for financial gain; 


e There has been a lack of appropriate engagement with the 
Commissioner by PML, with the information being provided often 


being questionable and contradictory; 


e PML had attempted shortly after the conclusion of the 
investigation to have the company struck off the Companies 
House register. This would appear to be a cynical attempt to 


avoid regulatory action. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner invited PML to provide representations to the 


Notice of Intent. No such representations were received. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 
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The Commissioner has attempted to consider the likely impact of a 

monetary penalty on PML. PML has failed to file any company accounts 

since its incorporation in November 2018 and so, despite her efforts, 

the Commissioner is unable to accurately assess PML’s financial status. 

However, the Commissioner notes that the director of PML sought to 

strike the Company off the register at Companies House immediately 

following the conclusion of the Commissioner’s investigation, and has 

failed to provide any representations either in respect of the 

contravention or its financial status. In the particular circumstances of 

this case, the Commissioner considers that a monetary penalty notice 

is a proportionate and appropriate response to the finding of a serious 


contravention by PML. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only 


telephoning consumers who want to receive these calls. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £250,000 (Two hundred and fifty 


thousand pounds) is reasonable and proportionate given the 
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particular facts of the case and the underlying objective in imposing the 


penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 21 January 2021 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government's general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
20 January 2021 the Commissioner will reduce the monetary penalty 
by 20% to £200,000 (Two hundred thousand pounds). However, 
you should be aware that the early payment discount is not available if 


you decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 


Information about appeals is set out in Annex 1. 
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67. The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 
penalty has not been paid; 

e all relevant appeals against the monetary penalty notice and any 
variation of it have either been decided or withdrawn; and 

e the period for appealing against the monetary penalty and any 


variation of it has expired. 


68. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 
Dated the 14t day of December 2020 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice has been served a right of appeal to 
the First-tier Tribunal (Information Rights) (the ‘Tribunal’) against the 


notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 


discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 


Leicester 


a) 


b) 
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LE1 8DJ 


Telephone: 0300 123 4504 


Email: grc@justice.gov.uk 


The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 


If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 


rule. 


The notice of appeal should state: - 


a) 


b) 


C) 


d) 


e) 


f) 


g) 


your name and address/name and address of your representative 


(if any); 


an address where documents may be sent or delivered to you; 


the name and address of the Information Commissioner; 


details of the decision to which the proceedings relate; 


the result that you are seeking; 


the grounds on which you rely; 


you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 
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h) if you have exceeded the time limit mentioned above the notice 


of appeal must include a request for an extension of time and the 


reason why the notice of appeal was not provided in time. 


Before deciding whether or not to appeal you may wish to consult your 
solicitor or another adviser. At the hearing of an appeal a party may 
conduct his case himself or may be represented by any person whom 


he may appoint for that purpose. 


The statutory provisions concerning appeals to the First-tier Tribunal 
(Information Rights) are contained in section 55B(5) of, and Schedule 
6 to, the Data Protection Act 1998, and Tribunal Procedure (First-tier 
Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory 
Instrument 2009 No. 1976 (L.20)). 
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